But I can't understand the last step of construction from $C_p$ and $C_q$ very well. Can someone explain it to me? Moreover, if I make $N = 55 = 11 \times 5$ instead of $5 \times 11$, that last step fails to give correct answer.

1 Answer
1

The basic idea of the CRT is that if $a$ and $b$ are relatively prime, working modulo $ab$ is the same as working modulo $a$ and modulo $b$ separately. In the case of modular exponentiation, exponentiating an element modulo $a$ and then modulo $b$ is much cheaper than modulo $ab$, because you can work with smaller exponents.

The second line gives $M^e = C_q+kq$. Plugging that into the first gives $C_q+kq \equiv C_p \pmod p$, so $kq \equiv C_p-C_q \pmod p$. Since $p$ and $q$ are relatively prime we can take $q^{-1} \bmod p$, so $k \equiv q^{-1}(C_p-C_q) \pmod{p}$, so $k = q^{-1}(C_p-C_q) + k'p$. Plugging that into $M^e = C_q+kq$ gives the desired expression.